Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 17:15
Static task
static1
Behavioral task
behavioral1
Sample
URGENT REQUEST FOR QUOTATION.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
URGENT REQUEST FOR QUOTATION.exe
Resource
win10v2004-20240508-en
General
-
Target
URGENT REQUEST FOR QUOTATION.exe
-
Size
775KB
-
MD5
3fd59a26eb8f645ac1f88e2ec2a3137a
-
SHA1
eb5135dd863bcfefa4a8e9e2fbd686068d6354e4
-
SHA256
785b8115d62f971593bacb7ddf5e0f0fa03ad2d3a077b91c88de788ee83f62b9
-
SHA512
486d81f9f07bd156ad5f1bcf127e4484399f8d43d1a6cfb09919f0971b276477c8bb5e7debd43087739c8c462488804f299017a043916c88ffd2318ecf7559d0
-
SSDEEP
24576:IWtb3BEXqdGFXcEm5t3bpP0PHBU4Z1ZM3fyD:TZBEqGKEm5HEhT06D
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.springandsummer.lk - Port:
587 - Username:
[email protected] - Password:
anu##323 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3140 powershell.exe 2988 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
URGENT REQUEST FOR QUOTATION.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation URGENT REQUEST FOR QUOTATION.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exedescription pid process target process PID 3032 set thread context of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exepowershell.exepowershell.exeRegSvcs.exepid process 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3140 powershell.exe 2988 powershell.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 3032 URGENT REQUEST FOR QUOTATION.exe 2988 powershell.exe 3140 powershell.exe 4452 RegSvcs.exe 4452 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3032 URGENT REQUEST FOR QUOTATION.exe Token: SeDebugPrivilege 3140 powershell.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 4452 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
URGENT REQUEST FOR QUOTATION.exedescription pid process target process PID 3032 wrote to memory of 3140 3032 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 3032 wrote to memory of 3140 3032 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 3032 wrote to memory of 3140 3032 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 3032 wrote to memory of 2988 3032 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 3032 wrote to memory of 2988 3032 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 3032 wrote to memory of 2988 3032 URGENT REQUEST FOR QUOTATION.exe powershell.exe PID 3032 wrote to memory of 4376 3032 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 3032 wrote to memory of 4376 3032 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 3032 wrote to memory of 4376 3032 URGENT REQUEST FOR QUOTATION.exe schtasks.exe PID 3032 wrote to memory of 4668 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4668 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4668 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe PID 3032 wrote to memory of 4452 3032 URGENT REQUEST FOR QUOTATION.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZYQQcPA.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZYQQcPA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E43.tmp"2⤵
- Creates scheduled task(s)
PID:4376 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4668
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5cbbd1c5c1d08a512bbc1baeaf36db82e
SHA12aa0a586c55620377cc28f29581b6db18427fbaa
SHA2562a0ae7dd877c8ca703fb93d1362b57ffb52cc389e466b6b566b2e2c3bb7ac59b
SHA512939b8188d8efcaeb840ca01dcabd24e0b555eba32d1474b69fe90c9b5c399bce10558b5b4431e8b70bf0a38947abdc626430b20e654a2a2f0dc24bc4dd91a309
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4w0m25d.hlp.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9E43.tmpFilesize
1KB
MD593c8b73d2a6d75ec190aaef95daf3ea1
SHA1fa88ac4cb8b21cf6574027bba4e3e7ff860b99f7
SHA256fcb981c4c0dec504e723f7037e3f51cf61266a0e8abb560813ebd508edfcd297
SHA512c00db4a29ecd4f80631259f45e003e53bbfea83807aca3d9fdc8c51bb2d473e9ee0b2f672301c69b65f6f1a622c7a8b759390b435eac1884c835e040be08fa36
-
memory/2988-76-0x00000000075E0000-0x0000000007C5A000-memory.dmpFilesize
6.5MB
-
memory/2988-88-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/2988-65-0x0000000071AD0000-0x0000000071B1C000-memory.dmpFilesize
304KB
-
memory/2988-30-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/2988-41-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/2988-48-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/2988-75-0x0000000006E50000-0x0000000006EF3000-memory.dmpFilesize
652KB
-
memory/2988-40-0x0000000005670000-0x00000000059C4000-memory.dmpFilesize
3.3MB
-
memory/2988-77-0x0000000006FA0000-0x0000000006FBA000-memory.dmpFilesize
104KB
-
memory/2988-84-0x00000000072E0000-0x00000000072FA000-memory.dmpFilesize
104KB
-
memory/3032-10-0x000000000B890000-0x000000000B92C000-memory.dmpFilesize
624KB
-
memory/3032-9-0x0000000006CD0000-0x0000000006D54000-memory.dmpFilesize
528KB
-
memory/3032-1-0x0000000000CB0000-0x0000000000D74000-memory.dmpFilesize
784KB
-
memory/3032-0-0x000000007532E000-0x000000007532F000-memory.dmpFilesize
4KB
-
memory/3032-16-0x000000007532E000-0x000000007532F000-memory.dmpFilesize
4KB
-
memory/3032-47-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3032-3-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/3032-2-0x0000000005E70000-0x0000000006414000-memory.dmpFilesize
5.6MB
-
memory/3032-8-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/3032-7-0x00000000058A0000-0x00000000058AC000-memory.dmpFilesize
48KB
-
memory/3032-4-0x0000000005820000-0x000000000582A000-memory.dmpFilesize
40KB
-
memory/3032-6-0x0000000005B40000-0x0000000005B62000-memory.dmpFilesize
136KB
-
memory/3032-50-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3032-5-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3140-92-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3140-79-0x0000000007970000-0x0000000007A06000-memory.dmpFilesize
600KB
-
memory/3140-52-0x0000000006410000-0x000000000645C000-memory.dmpFilesize
304KB
-
memory/3140-53-0x0000000006990000-0x00000000069C2000-memory.dmpFilesize
200KB
-
memory/3140-54-0x0000000071AD0000-0x0000000071B1C000-memory.dmpFilesize
304KB
-
memory/3140-64-0x0000000007390000-0x00000000073AE000-memory.dmpFilesize
120KB
-
memory/3140-23-0x0000000005CD0000-0x0000000005D36000-memory.dmpFilesize
408KB
-
memory/3140-21-0x0000000005580000-0x00000000055A2000-memory.dmpFilesize
136KB
-
memory/3140-24-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/3140-20-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3140-78-0x0000000007760000-0x000000000776A000-memory.dmpFilesize
40KB
-
memory/3140-51-0x00000000063C0000-0x00000000063DE000-memory.dmpFilesize
120KB
-
memory/3140-80-0x00000000078F0000-0x0000000007901000-memory.dmpFilesize
68KB
-
memory/3140-81-0x0000000007920000-0x000000000792E000-memory.dmpFilesize
56KB
-
memory/3140-83-0x0000000007930000-0x0000000007944000-memory.dmpFilesize
80KB
-
memory/3140-19-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3140-85-0x0000000007A10000-0x0000000007A18000-memory.dmpFilesize
32KB
-
memory/3140-17-0x0000000075320000-0x0000000075AD0000-memory.dmpFilesize
7.7MB
-
memory/3140-18-0x00000000056A0000-0x0000000005CC8000-memory.dmpFilesize
6.2MB
-
memory/3140-15-0x0000000002AA0000-0x0000000002AD6000-memory.dmpFilesize
216KB
-
memory/4452-42-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/4452-93-0x00000000062A0000-0x00000000062F0000-memory.dmpFilesize
320KB